2d3bc9ca649270d68e1bd374ef2e818b2f57bbd80455cd6e8a384a7cc418fab0

General

Target
2d3bc9ca649270d68e1bd374ef2e818b2f57bbd80455cd6e8a384a7cc418fab0
Size 8.4MB
Sample260801-bmr7asvbra
SHA256 2d3bc9ca649270d68e1bd374ef2e818b2f57bbd80455cd6e8a384a7cc418fab0
MD5 aba8c673adb6af97bd07544a6324d287
SHA1 30046311beb268f4d9171fc16b4ca8ecb2067f67
SHA512 d6d6c37e46f874fa01d00967d36f0e6d2980552d29a0d2fe7b4bc7e168b4315d4382ce90378e0e39c0f648efe897c92a07f0002f8bdbdbb3a352ad1da31e9cc5
SSDEEP 196608:MY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezW:MY4qjnt3t0mrWDbL
TLSH
T1CC963365E0E7CF9B059898DC07611A1ED83490242D251E873ACFF2AFB1A35E27C377A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 0bd57376d55904cb80acc8ffafcfad19a8299b7735766ff92894f2ddec358eff
- MD5 6970584de43151fb8845b11533742cd8
- SHA1 18b561a3dfc6e240e6592b033800aababb4271b6
- SHA512 0c4f7af87d585470ffcff613af3da918de3c1bcf4c1b88259fa8d2684bf39215822f588faa89f222296f59275162c0dcc06a9a38c428b4e43e1b33dc203e8ea4
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshK:rBjf4vFYmROxL1
- TLSH
  T115963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2